# Root remediation notes

F02: Linux/Windows Web shortcut creation selects an existing regular installed manager or the running portable copy. It performs no manager executable write and cannot downgrade or race updater replacement. Nonregular installed target fails. Existing Linux public shortcut regression proves manager bytes/mode preserved; native Windows cscript regression added. New portable shortcut references running copy, no implicit executable installation.

F13: artifact selection requires cpuid full x64 level 3/4, not AVX2 boolean. Linux/macOS Intel fallback uses complete cpuid baseline with OS AVX state. Feature mask regression individually removes all level3 prerequisites, confirms fail-conservative; complete v3/v4 recognized. Package CPU-level cache now detects CPU only without GPU subprocesses.

F14: scoped override Tailwind CLI -> @parcel/watcher2.6.0 replaces micromatch/braces with picomatch. Exact locked packages/integrity; no forced downgrade/audit suppression. npm ci/audit clean, unchanged Tailwind CSS bytes before frontend changes, real Tailwind --watch source edit observed italic class addition. Standalone smoke script/log preserved. Runtime vendors unchanged.

Cleanup: generator fixed path.tmp writer retired; production callers use shared durable unique-temp internal/fileops.AtomicWrite. Existing duplicate writer unit test retired; generator suite/race and fileops regressions validate behavior. constants.SupportsMPVOverlay canonical six-method table provided UI/TUI. Model-based Mac codec inference now takes existing GPUInfo rather than second system_profiler; native CGO runtime probing unchanged.

Reachability: common inventory exported XDG/path formatting convenience helpers, keyring context-free compatibility wrappers, CPU/platform elevation helpers, locale helpers, Flush, release/version facades and Thumbfast license test/license compliance accessor are retained as supported API/test/tool seams. ParsePrivateKey is required generator tool (all-command analysis). No blind reachability-based API deletion. Installer/Web/config retained items classified by owning reviewers. Staticcheck correctness and U1000 plus cross-target application builds are gates.

Native: win-dev SSH alias updated to owner-supplied10.0.7.77, endpoint host keys matched existing trusted VM keys. Focused Windows private file owner/DACL, atomic replacement, private journal and no-overwrite shortcut checks execute on the dedicated agent account. Native Mac arm64 suites run in disposable profiles with actual empty-DMG and Applications recovery fixtures. See final native transcripts and report for helper skips and accepted Windows ARM64/Intel Mac coverage gaps.

No versions, tags, releases or external production services changed.

Native follow-ups: private Windows files explicitly bind process-user ownership, not elevated-token default Administrators; metadata tests ignore only informational AUTO_INHERITED. Atomic writes use private temporary files for private modes and a bounded write-through Windows replacement retry. Web shortcut cscript runs under an owned30s runner.